fix(installer): require explicit noninteractive consent

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/install.sh

@@ -26,8 +26,9 @@ usage() {
 Install Paperclip on macOS, Linux, or WSL2.
 
 Usage:
-  curl -fsSL https://paperclip.ing/install.sh | bash
-  curl -fsSL https://paperclip.ing/install.sh | bash -s -- [options]
+  curl -fsSLO https://paperclip.ing/install.sh
+  bash install.sh [options]
+  curl -fsSL https://paperclip.ing/install.sh | bash -s -- --no-prompt [options]
 
 Options:
   --canary                 Install the canary channel
@@ -155,8 +156,8 @@ if [ -n "$REF" ] || [ -n "$REPO" ]; then
   fail "git-ref installs are not available in this installer build; omit --ref and --repo"
 fi
 
-if [ ! -t 0 ] || [ ! -t 1 ]; then
-  NO_PROMPT=1
+if { [ ! -t 0 ] || [ ! -t 1 ]; } && [ "$NO_PROMPT" != "1" ]; then
+  fail "non-interactive installation requires explicit --no-prompt; download the script first for interactive review"
 fi
 
 if [ "$VERBOSE" = "1" ]; then

scripts/test-install-sh-docker.sh

@@ -101,6 +101,12 @@ fi
   exit 1
 }
 
+echo "==> piped mode requires explicit consent"
+if run_with_node piped-rejected bash -c 'cat /paperclip-scripts/install.sh | bash -s -- --no-onboard'; then
+  echo "Expected piped install without --no-prompt to fail" >&2
+  exit 1
+fi
+
 echo "==> piped --no-prompt"
 run_with_node piped bash -c 'cat /paperclip-scripts/install.sh | bash -s -- --no-prompt --no-onboard'
 assert_line "$RESULTS_DIR/piped.args" "--yes"